mirror of
https://github.com/screentinker/screentinker.git
synced 2026-08-14 06:16:20 -06:00
c91b96ab91
Third review pass. It confirmed the crash wrapper holds (~13,000 hostile requests,
no fourth crash), the SSRF rewrite holds (77 vectors, every CIDR boundary proven),
the rate-limiter rewrite closed the login brute-force bypass, and /sso/claim rejects
every wrong token kind. It also found that two things I built yesterday did not do
what they claimed.
THE 8-HOUR LIMIT DID NOT BOUND SQUATTING
Pressing Verify on an expired claim REISSUED it in place, renewing the clock — so one
request per window held a domain forever, through the endpoint meant to enforce the
limit. Worse, a renewal was not a new claim, so the operator was notified exactly once,
on day zero: a tenant could sit on a company's domain for a year off a single stale
alert. A lapsed claim is now RELEASED. Re-adding it is an ordinary new claim: new
token, and the operator is told again. Squatting is not impossible; it is loud.
A DELEGATED PROOF NAME COULD FORGE A DOMAIN
A TXT lookup follows CNAMEs, and RFC 4592 means a wildcard `*.victim.com` synthesizes
`_screentinker-verify.victim.com` too — so a wildcard CNAME let whoever controls its
target prove a domain they do not own, turning an ordinary subdomain takeover into
every `@victim.com` login. A reviewer did this against a real authoritative zone. The
proof name is now refused if it is a CNAME, which is stricter than ACME's dns-01, and
the comment that claimed wildcards "cannot be mistaken for a proof" — true only for
wildcard TXT — has been corrected.
MY VERIFY BUTTON REPORTED FAILURE ON SUCCESS
`await load()` — the loader is `loadSso()`. The ReferenceError went into a bare catch,
so a correct DNS proof showed "Could not verify that domain" and left the card stale.
On the expired branch the admin kept publishing a token the server had already rotated.
ALSO FIXED
- deleting a provider stranded its verified domains (no FK, UNIQUE, never expires) so
the domain was blocked for EVERY org forever with no in-product recovery, and its
users could neither sign in nor reset. Delete now releases the domains and returns
the accounts to local, in one transaction; a cascade FK backstops it.
- isOrphanedFederated read absence-of-config as proof-of-deletion, so unsetting
GOOGLE_CLIENT_ID made every Google account password-resettable instance-wide, and
irreversibly. Restricted to org-provider slugs.
- `email_domains: null` (not undefined) took the destructive branch and deleted every
DNS proof an organization had.
- unbounded domain lists: 400 domains sent 401 emails; now capped at 50, one digest
per save, and /api/organizations is rate-limited at all for the first time.
- login and register responses carried password_reset_hash and email_verify_hash —
live account-takeover credentials handed to the browser. One sanitiser now.
- trailing-dot hostname (`https://localhost./`) slipped the SSRF guard.
- asyncRoute's own catch could throw and kill the process it exists to protect.
- a legacy DB whose typed domains were never verified now says so LOUDLY at boot
instead of silently locking every federated user out.
TESTS
Two of the previous round's tests passed against the code they were named after: one
asserted UNIQUE against the test harness's own CREATE TABLE rather than the shipped
schema, the other used two different domains so no ordering was exercised. Both
replaced and confirmed load-bearing. Seven mutations now turn the suite red, including
removing the CNAME refusal, the verified_at filter, and the expiry itself.
1598 tests pass. Delete-release, lapse-release and the leak fix verified against a
running server.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bvjey4FNam49MN7ybjcq6A
|
||
|---|---|---|
| .. | ||
| agency-layouts.js | ||
| agency-targets.js | ||
| apk-cache.js | ||
| apk-signature.js | ||
| app-settings.js | ||
| billing-token.js | ||
| billing.js | ||
| bounded-snapshot-store.js | ||
| branding.js | ||
| brightsign-package.js | ||
| brightsign-snapshot-queue.js | ||
| brightsign-update.js | ||
| chunked-prune.js | ||
| command-queue.js | ||
| content-ack-limiter.js | ||
| content-ingest.js | ||
| device-identity.js | ||
| device-sanitize.js | ||
| device-settings.js | ||
| device-timezone.js | ||
| domain-verify.js | ||
| emailVerify.js | ||
| flap-limiter.js | ||
| ghcr-check.js | ||
| image-gen.js | ||
| incident-classify.js | ||
| item-duration.js | ||
| limiter-telemetry.js | ||
| liveness.js | ||
| log-coalescer.js | ||
| login-lockout.js | ||
| media-mute.js | ||
| media-orientation.js | ||
| media-tools.js | ||
| numeric-code.js | ||
| oidc-providers.js | ||
| oidc.js | ||
| orientation-style.js | ||
| ota-breaker.js | ||
| ota-download-guard.js | ||
| pair-lockout.js | ||
| parse-size.js | ||
| passwordReset.js | ||
| permissions.js | ||
| player-cache-policy.js | ||
| player-capabilities.js | ||
| player-media-health.js | ||
| public-email-domains.js | ||
| reconnect-throttle.js | ||
| recovery-grant.js | ||
| rolling-counter.js | ||
| safe-socket.js | ||
| schedule-eval.js | ||
| schema-check.js | ||
| secretbox.js | ||
| session-settle.js | ||
| settings-pin.js | ||
| socket-rooms.js | ||
| ssrf-guard.js | ||
| status-log-writer.js | ||
| sync-backend.js | ||
| tcp-keepalive.js | ||
| tenancy.js | ||
| tenant-cascade-migration.js | ||
| thumbnail-backfill.js | ||
| totp-lockout.js | ||
| totp.js | ||
| transition-bundle.js | ||
| transition-config.js | ||
| upload-sniff.js | ||
| user-deletion.js | ||
| wall-geometry.js | ||
| wgt-cache.js | ||
| zone-validate.js | ||